Identity

A separate system from the OpenPGP key above, used for day-to-day signed email rather than the proofs on this page. Trust here comes from a Certificate Authority chain rather than the account-based proofs Keyoxide/Keybase/did:web rely on - Sectigo vouches for mailbox control, the same model browsers use to trust HTTPS.

The DID document at /.well-known/did.json resolves to did:web:chrisbmn.com and enumerates verified service endpoints and linked accounts in a format any W3C-compliant DID resolver can parse. Defined by W3C DID Core 1.0 and the did:web method spec. Served with Content-Type: application/did+json.

This is the simplest proof on the page: Mastodon checks that the profile's link back has a matching rel="me" tag on the target page, the same mechanism IndieWeb sites have used for years. It doesn't tie into the OpenPGP key or notations above - it's a separate, lower-ceremony confirmation that the account and this domain are controlled by the same person.

Each proof works on the same principle: a platform-specific location (a gist, a DNS record, a profile bio, a signed file) contains a reference to the key fingerprint. The OpenPGP key contains a notation pointing back to that location. The verifier fetches both sides and confirms they match.

Using three independent systems provides redundancy - no single service going offline invalidates the proofs, and each uses a different verification architecture. Keyoxide is fully trustless and open-source. Keybase uses a centralised but widely recognised model with broader platform support (including Reddit). did:web is a W3C standard built for machine-readable identity resolution.

The underlying key is available via WKD for automatic discovery by OpenPGP-aware clients, and on keys.openpgp.org for manual lookup. Anyone with gpg can independently verify each claim without trusting any of these services.